diff --git a/epdb/logic.py b/epdb/logic.py
index 6b322d1e..bd90b044 100644
--- a/epdb/logic.py
+++ b/epdb/logic.py
@@ -378,6 +378,10 @@ class PackageManager(object):
         # EDIT START
 
         if package.classification_level == Package.Classification.SECRET:
+            if user.principal_type == user.PrincipalType.APP:
+                if not user.app_details.secret_allowed or package.data_pool != user.app_details.data_pool:
+                    return False
+
             if package.data_pool not in groups:
                 return False